The cloud intersects with personal and professional worlds for many people. Want to share photos with family from a recent trip? Upload them to a shared cloud drive and text out the link for access. Need to have several hands on a project that is subject to a strict deadline? Create a collaborative document stored in the cloud that updates in real time so users can view and edit instantaneously. In the digital age, people want everything available immediately. This need aligns perfectly with the cloud’s features, which means the technology will only continue to trend.

This is especially true looking from a business perspective, as organizations in most industries have gone remote to some degree or deploy global operations. As with any operational process or tool, security should be a top concern. But how can organizations sufficiently secure the cloud – especially when sensitive company data backups are maintained in a public cloud network subject to third-party controls? Here are some basic cloud features and security tips that will go a long way and create a solid foundation when the time for added protective measures arises.

Private vs. Public Cloud

Put simply, the difference between private and public cloud rests on infrastructure. Private cloud is akin to a data center and will use an organization’s internal infrastructure. In most situations, the organization owns the private cloud. A public cloud operates off a shared infrastructure and has an outside host provider. The organization will pay a subscription fee and will not need to expend a large chunk of money to set up the network internally, unlike a private cloud model. Some organizations take a hybrid approach and integrate both private and public clouds into operations. Regardless of which model is chosen, organizations need to maintain proper security controls to protect their data and remain compliant with all legal, regulatory, and contractual obligations.

Security Best Practices

With the overwhelming amount of data breaches emerging in recent years, organizations must ensure there are adequate physical and cyber security controls in every setting involving data. Security considerations for the private and public cloud will differ in several regards. When creating a private cloud network, the organization will be solely responsible for managing all security efforts whether done internally or outsourced. Best practices include firewall protections, physical security measures, multi-factor authentication, and added internal controls. Even if not outsourced completely, consulting with experts familiar with private cloud infrastructures helps guarantee protection is sufficient and updated when necessary.

Securing the public cloud is a frontier many organizations have not yet conquered or even believe to be necessary because it involves a third party tasked with security responsibilities. Although true, it is still crucial for organizations to ensure that the cloud provider is deploying sufficient protective measures and independently enhance security in the public cloud. More controls may be needed simply depending on the nature of data an organization is storing to keep hackers at bay, such as sensitive data subject to regulations that require higher measures to keep compliant. Additionally, many agreements incorporate shared responsibility dictating physical security controls to the provider and other obligations to the subscriber (like encryption or authentication). Here are three security basics that will guide organizations on their journey of securing a public cloud:

1. Shared responsibility: It is crucial that subscribers understand their role in the shared responsibility model, which is the foundation of public cloud security. This is an area many do not consider because they believe their information is secure simply because the provider will deploy security measures over data in the cloud. However, provider security only represents a portion of the needed security and leaving this gap unfilled will significantly increase breach risk. Cloud providers will generally give their customers a diagram delineating security responsibilities. Basically, the provider only owns the security of the cloud, including infrastructure and network. However, the subscriber is responsible for security in their cloud environment. What is needed will depend on the individual services selected and configurations deployed, such as a specific storage solution.

2. Provider preference: Cloud service providers have a vested interest in maintaining security over the data guarded on their platforms and want to ensure their subscribers deploy sufficient controls to limit exposure. As such, many providers will create security recommendations that subscribers should make an effort to understand and match. While this can be very technical, begin with simpler endeavors like identity, access management, login capabilities, encryption, and data storage controls. Understanding these basic security mechanisms and aligning with provider preferences will help organizations better identify future gaps that will require tool augmentation and increased investment.

3. Asset management: Understanding the data an organization currently has in the cloud is crucial to define appropriate security needs. Necessary steps include inventory of cloud resources (data and services), consideration of team silos, reference to industry framework, and risk evaluation. Also determine any compliance obligations certain data invokes that would indicate the need for stronger security. This includes regulatory, legal, and contractual requirements. Remember that asset management is a continuous process as new and existing data flows into the cloud. Depending on storage or security needs, an organization may need to utilize more than one public cloud.

4. Identity authentication: Gaining access to login credentials or failure to require identity authentication is the easiest way for hackers to get into the cloud. Too many breaches result from stolen, leaked, or improperly configured credentials. Organizations can prevent this by encrypting login data, adding additional authentication measures, managing and monitoring user identities, instituting alerts for failed access attempts, and utilizing trusted technology to ensure these measures are effective.

These basic security steps create a solid foundation to build upon and will limit the risk of highly preventable breaches. Consulting with the cloud provider and security experts on more complicated measures will help organizations meet their shared security responsibilities, maintain relevant compliance, and properly safeguard their data in the public cloud.

Conclusion

Cloud security is a new concept for many organizations. However, there needs to be widespread adoption across industries to promote good security habits and keep company, client, and consumer data safe. Incorporating security into quality process is crucial for cloud providers and an organization’s security team. The baseline considerations discussed above supplies the tools to create a confident foundation of cloud security that limits breach potential. Remember that cloud technology is dynamic which means that security needs will shift or evolve, so auditing is crucial to maintain proper data protection.

For more information, consider listening to the corresponding Cyberside Chats podcast.